Does anyone have a list of hosts they allow in their traffic rules for 
the unauthenticated role to allow Apple Updates to happen before 
authentication?  I originally allowed:

swscan.apple.com      equals
swquery.apple.com    equals

but they weren't enough, so I did a packet capture and saw that I needed 
to allow some akamai servers to get it to work, but obviously I can't do 
that, or users will get a
whole slew of sites they shouldn't be getting.

Thoughts?

-- 
--Homer Manila
Network Security Administrator
OIT, American University